Is CVE-2026-97076 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-97076 being exploited in the wild.

How severe is CVE-2026-97076?

High severity, with a CVSS score of 7.5, published 9 October 2026.

Which products and versions are affected?

WP Media WP Rocket before 3.23.5.

Is there a fix for CVE-2026-97076?

Yes: fixed in 3.23.5. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-97076 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-97076?

Check whether you run WP Media WP Rocket at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-97076: WP Media WP Rocket code injection in regular expression

CVE-2026-97076 · Severity: high · CVSS 7.5 · Published 2026-10-09

WP Rocket is a WordPress caching and optimization plugin used on many websites to improve performance. An executable regular expression error in the plugin allows attackers to inject and execute arbitrary code on affected websites, potentially leading to complete site compromise. This vulnerability affects all versions before 3.23.5 and requires only network access to exploit.

Technologies: WP Media WP Rocket. Vendors: WP Media.

Quick answers

Is CVE-2026-97076 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-97076 being exploited in the wild.
How severe is CVE-2026-97076?: High severity, with a CVSS score of 7.5, published 9 October 2026.
Which products and versions are affected?: WP Media WP Rocket before 3.23.5.
Is there a fix for CVE-2026-97076?: Yes: fixed in 3.23.5. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-97076 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-97076?: Check whether you run WP Media WP Rocket at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 3.23.5

Technical details

An executable regular expression error in WP Rocket allows code injection through improper handling of regex patterns. The vulnerability is unauthenticated and network-accessible, enabling remote attackers to execute arbitrary code with the privileges of the web server. A patch is available in version 3.23.5 and later.

Affected products

WP Media WP Rocket before 3.23.5

Timeline

2026-10-09: disclosed
2026-10-07: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.